alkcall 0.8.0

Call + channels RPC: structured JSON operations, streaming subscriptions, service discovery, and N-channel multiplexing over one transport stream
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

//! Authentication primitives: `AuthContext`, `Identity`, `AuthToken`,
//! `IdentityProvider`.
//!
//! See `docs/architecture/` for the full specification. The trait-based
//! `IdentityProvider` is the integration point — the assembly layer supplies
//! the impl (config-backed, vault-backed, or persistence-adapter-backed) and
//! the call protocol resolves identity per-request through it.

use std::collections::HashMap;
use std::net::SocketAddr;

use serde::{Deserialize, Serialize};

#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
pub struct Identity {
    pub id: String,
    pub scopes: Vec<String>,
    pub resources: HashMap<String, Vec<String>>,
}

#[derive(Debug, Clone)]
pub struct AuthToken {
    pub raw: Vec<u8>,
}

#[derive(Clone)]
pub struct AuthContext {
    pub identity: Option<Identity>,
    pub alpn: Vec<u8>,
    pub remote_addr: Option<SocketAddr>,
    pub tls_client_fingerprint: Option<String>,
}

impl AuthContext {
    /// Construct an `AuthContext` with no identity, no fingerprint, and no
    /// remote address — only the ALPN is set. For POCs, tests, and handlers
    /// that don't require auth.
    pub fn anonymous(alpn: impl Into<Vec<u8>>) -> Self {
        Self {
            identity: None,
            alpn: alpn.into(),
            remote_addr: None,
            tls_client_fingerprint: None,
        }
    }
}

pub trait IdentityProvider: Send + Sync + 'static {
    fn resolve_from_fingerprint(&self, fingerprint: &str) -> Option<Identity>;
    fn resolve_from_token(&self, token: &AuthToken) -> Option<Identity>;
}

/// An [`IdentityProvider`] that resolves nothing — every lookup
/// returns `None`. The identity-less posture for consumers that serve
/// ops with no ACL restrictions (or gate by other means), and the
/// default for [`crate::channels::client::ServingConfig`]. Downstream
/// crates supply a real impl (config-backed, vault-backed) to resolve
/// tokens or fingerprints.
pub struct NoopIdentityProvider;

impl IdentityProvider for NoopIdentityProvider {
    fn resolve_from_fingerprint(&self, _: &str) -> Option<Identity> {
        None
    }
    fn resolve_from_token(&self, _: &AuthToken) -> Option<Identity> {
        None
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn identity_fields_and_equality() {
        let mut resources = HashMap::new();
        resources.insert("service".to_string(), vec!["gitea".to_string()]);
        let id = Identity {
            id: "SHA256:abc123".to_string(),
            scopes: vec!["relay:connect".to_string()],
            resources,
        };
        let id2 = id.clone();
        assert_eq!(id, id2);
        assert_eq!(id.id, "SHA256:abc123");
    }

    #[test]
    fn auth_token_is_clone() {
        let token = AuthToken {
            raw: b"alk_test".to_vec(),
        };
        let cloned = token.clone();
        assert_eq!(token.raw, cloned.raw);
    }

    #[test]
    fn auth_context_is_clone() {
        let ctx = AuthContext {
            identity: None,
            alpn: b"alk/test".to_vec(),
            remote_addr: None,
            tls_client_fingerprint: None,
        };
        let cloned = ctx.clone();
        assert_eq!(cloned.alpn, b"alk/test");
        assert!(cloned.identity.is_none());
    }

    #[test]
    fn auth_context_anonymous_sets_alpn_only() {
        let ctx = AuthContext::anonymous(b"alk/test");
        assert_eq!(ctx.alpn, b"alk/test");
        assert!(ctx.identity.is_none());
        assert!(ctx.remote_addr.is_none());
        assert!(ctx.tls_client_fingerprint.is_none());
    }
}